419ac31cd15eaad917d8d5e6750be336af9e363a29869e33115ca4d4cf7c997b

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 20:53

Target

0d8e8e3026fcef1215838092b6bc4db0_NeikiAnalytics.dll
Size

81KB
MD5

0d8e8e3026fcef1215838092b6bc4db0
SHA1

03d292fef81c0efb6eadd0156bf3e3f4f975cfcb
SHA256

419ac31cd15eaad917d8d5e6750be336af9e363a29869e33115ca4d4cf7c997b
SHA512

657e6181849ee81dc119b7e080b0370c470f8bf6734857fa60da2fc65acfe7143b60190622250f00bd979da50b736b5c2ff5cc308e48c0b0b8581f7e9e11be5b
SSDEEP

1536:uByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8W4:Pv4JKXTx71wnArSsXFpeXq8W4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1436	3304	rundll32.exe	92
PID 3304 wrote to memory of 1436	3304	rundll32.exe	92
PID 3304 wrote to memory of 1436	3304	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d8e8e3026fcef1215838092b6bc4db0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d8e8e3026fcef1215838092b6bc4db0_NeikiAnalytics.dll,#1
  2⤵
  PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3084